GraphQL Enhanced MCP Server: Setup for Claude, Cursor and Other Apps
Lets Claude, Cursor and other assistants explore a GraphQL API and run queries against it, with changes turned off by default.
This is a community server that runs on your computer. You point it at one GraphQL API with the ENDPOINT setting, and your assistant can then read the schema and run queries. It can load only the types you ask about, so a large schema does not fill the assistant's context. You can list several addresses, separated by commas, to query them together.
By default it only reads: mutations are blocked until you set ALLOW_MUTATIONS to true. If you do not set ENDPOINT, it falls back to a demo Discord API, so always set it. If the API needs a login, add the token in the HEADERS setting.
Good for
- Developers who want an assistant to read their GraphQL schema and write queries
- Teams with large schemas who want the assistant to load only the types it needs
- Anyone querying several GraphQL APIs, such as Neo4j-backed ones, as one
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install mcp-graphql-enhanced
Claude Code
- 1
Copy this prompt.
Add the mcp-graphql-enhanced server to Claude Code. Run this command: claude mcp add graphql-enhanced -e ENDPOINT=<ENDPOINT> -- npx -y @letoribo/mcp-graphql-enhanced Ask me for ENDPOINT and only put the values in that config, nowhere else. Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires Node.js.
Built from the package data we hold. Not yet tested by us.
Tools
Read a GraphQL API's types and fields
Returns the schema of the API, or only the types you name, with fields and relations. With no type names it returns a short overview of the connected endpoints instead. It only reads.
Try: “Show me the User and Message types and how they connect.”
Network ·
introspect-schemaRun a GraphQL query against the API
Runs a GraphQL query on the API and returns the data or the errors. Mutations are blocked unless you start the server with mutations allowed. The assistant can also pass another endpoint address or extra headers in the call.
Try: “List the first 10 repositories with their star counts.”
Write ·
query-graphql
Read from the source code
Permissions
medium risk · 4 things to watch
Medium risk
The assistant can read anything your API token can read, and can send queries to any GraphQL address it is given. Mutations are off by default, so keep them off and use a read-only token while you try it.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only modeHow to turn it on
Watch out for
The assistant can point it at another address
Both tools take an optional endpoint argument that switches the target for the rest of the session. The server does not restrict it, so use a token that only reaches what you intend. github.com
Turning on mutations lets it change data
With ALLOW_MUTATIONS=true the query tool can run any mutation the API permits, including deletes. Keep it off unless you need writes. github.com
The optional HTTP mode listens on all interfaces
If you enable HTTP mode, the published code listens on 0.0.0.0, so other machines on your network can reach it. It is off by default outside the MCP Inspector. npmjs.com
Without ENDPOINT it queries a demo API
The documented default is a public Discord demo endpoint. Set ENDPOINT before you use it. github.com
Security advisories
No published security advisories as of Nov 1, 2026.
Technical details
| Turning on read-only | Leave ALLOW_MUTATIONS unset or false. The query tool then refuses any mutation. |
|---|---|
| Talks to | The GraphQL endpoint you set. Any other GraphQL address the assistant passes in a tool call |
| Sign-in and keys | The token, if any, sits in the HEADERS setting of your assistant's config on your machine. |
| Scopes |
|
Questions
Is mcp-graphql-enhanced official?
No. It is a community project that describes itself as a drop-in replacement for the mcp-graphql server.
Do I need an API key?
Only if your GraphQL API needs one. Set the address in ENDPOINT and put any token in HEADERS, for example an Authorization bearer header.
Can it change data?
Not by default. Mutations are blocked until you set ALLOW_MUTATIONS to true. With it on, the assistant can run any mutation the API allows.
Does it work with a large schema?
Yes, that is its main selling point. Its introspection tool can return only the types you name, to a depth you choose, so the whole schema does not load into the chat.
Can it query more than one API?
Yes. Put several addresses in ENDPOINT, separated by commas, and it combines the results. The assistant can also switch to a different address in a single call.
Does it have a visual interface?
Yes, if you turn on HTTP mode with ENABLE_HTTP=true. It then serves a GraphiQL page in your browser, on port 6274 unless you change it.
Is it free?
Yes. It is open source under the MIT license and runs on your computer.
Information
updated Nov 2, 2026
- Publisher
- Community
- Package
@letoribo/mcp-graphql-enhanced- Registry
- npm
- Transport
- stdio
- Version
- 4.15.5
- License
- MIT
- Last commit
- Oct 28, 2026
- Open issues
- 0
- Listed in
- Official MCP registry
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 3Hide
- github.com · github.com
- registry.npmjs.org · registry.npmjs.org
- www.npmjs.com · npmjs.com